---
description: How to emit a Content Security Policy header from your own stack - Angular, Vue, Next.js, SvelteKit, Astro, Django, Rails, Laravel, Express, Spring Boot, Nginx and more.
---

# Frameworks

A Content Security Policy is just an HTTP response header, but *how* you emit it - and especially how you generate a fresh nonce for every response - is different in every stack. Some frameworks now build it in. Others expect you to write the middleware yourself.

These pages cover the practical side: where the header comes from, how to wire up nonces, and how to point the reports at your account.

## Front-end frameworks

- [Next.js](/frameworks/next-js/) - nonces in the proxy layer, and what they cost you in rendering
- [Angular](/frameworks/angular/) - `ngCspNonce` for the inline styles Angular injects
- [Vue](/frameworks/vue/) - why the full build needs `'unsafe-eval'`, and how to avoid it
- [SvelteKit](/frameworks/sveltekit/) - built-in `csp` config with hash, nonce and auto modes
- [Astro](/frameworks/astro/) - built-in hashes from Astro 6, and why they cannot report
- [Nuxt](/frameworks/nuxt/) - `'strict-dynamic'` and per-request nonces via Nuxt Security
- [React Router](/frameworks/react-router/) - nonce propagation, and the three places streaming needs it

## Backend frameworks

- [Django](/frameworks/django/) - built into core since Django 6.0, with `SECURE_CSP` and a nonce context processor
- [Ruby on Rails](/frameworks/rails/) - the `content_security_policy` DSL, nonce generator and `csp_meta_tag`
- [Laravel](/frameworks/laravel/) - middleware plus Vite's first-party nonce integration
- [Express](/frameworks/express/) - Helmet's `contentSecurityPolicy` middleware and per-request nonces
- [Spring Boot](/frameworks/spring-boot/) - Spring Security's header writers
- [ASP.NET Core](/frameworks/asp-net-core/) - Blazor's CSP guidance, and why the `<meta>` tag approach cannot report

## Web servers

- [Nginx](/frameworks/nginx/) - `add_header`, and the inheritance rule that silently drops your policy
- [Apache](/frameworks/apache/) - `mod_headers` and why you want `always`
- [IIS](/frameworks/iis/) - `<customHeaders>` in `web.config`

Setting the header somewhere else? Our [Platforms](/platforms/) guides cover ecommerce platforms, tag managers and CDNs, and the [Content Security Policy](/setup/csp/) guide covers the policy itself.

## If your policy arrives in a `<meta>` tag, it cannot report

This is the single most common way to end up with a policy that works and tells you nothing.

A CSP delivered as `<meta http-equiv="Content-Security-Policy">` silently ignores four directives: `report-uri`, `report-to`, `frame-ancestors` and `sandbox`. The policy still applies. The reporting simply never happens, with no error and nothing in the console to suggest anything is missing.

Several mainstream tools deliver CSP exactly this way by default:

- [Astro](/frameworks/astro/) uses a `<meta>` tag exclusively for its built-in CSP
- [SvelteKit](/frameworks/sveltekit/) uses one on prerendered pages
- [ASP.NET Core](/frameworks/asp-net-core/) - every example in Microsoft's Blazor guidance is a `<meta>` tag
- [Square](/platforms/square/) documents its Web Payments SDK policy as a `<meta>` tag

If you need violation reports - and on a payment page, PCI DSS 4.0 effectively requires that you have them - the policy has to be an HTTP response header. You can run both: an enforcing `<meta>` policy from your framework, and a `Content-Security-Policy-Report-Only` header from your server or CDN that does the reporting.

## A note on nonces

Every nonce-based policy has the same two requirements, whatever the stack: the value must be **unpredictable**, and it must be **different on every response**. That rules out caching a rendered page together with its header, and it rules out anything that reuses a value across requests.

If you cannot generate a per-response value - a static site, a CDN-cached page, a platform that will not let you run code - use hashes instead, or deliver the policy from a layer that can. Our [Cloudflare](/platforms/cloudflare/) page covers the edge route.